An information security detection method for blockchain system

Abstract

The present invention discloses an information security detection method for a blockchain system. When the security detection is triggered, it starts from the algorithm layer intelligent detection, and sequentially triggers the protocol layer intelligent detection, the implementation layer intelligent detection, the usage layer intelligent detection, and the system layer intelligent detection. The detection steps adopted at each level are: identifying and evaluating the input or intercepted message information; analyzing the detection content of whether it is unknown whether there is a vulnerability, and collecting the vulnerability information at the same time; generating logs and blocks to realize data storage and transmission. The present invention innovatively proposes a systematic blockchain security detection method, which realizes the security detection of the entire blockchain system by sequentially triggering the algorithm layer intelligent detection, the protocol layer intelligent detection, the implementation layer intelligent detection, the usage layer intelligent detection, and the system layer intelligent detection. The present invention fills the research gap in the field of blockchain security at home and abroad to a large extent.

Description

Technical Field

[0001] The present invention belongs to the field of blockchain information security technology, and specifically, relates to an information security detection method for a blockchain system. Background Art

[0002] From the perspective of existing related research fields, blockchain security issues mainly exist in the following aspects: cryptographic mechanism vulnerability issues; consensus protocol attack issues; smart contract code vulnerability threat issues; privacy security issues; system security issues. Security detection research is more focused on vulnerability detection in smart contract code. For example, Zheng Zhongbin et al. summarized and analyzed several common security vulnerabilities in smart contracts, and Fu Menglin et al. summarized and compared current smart contract vulnerability detection methods. However, security vulnerability problems exist in the entire blockchain system. Currently, research on related detection technologies lacks systematicity and comprehensiveness, and there is no security detection method for the entire blockchain system. Summary of the invention

[0003] In order to overcome the above-mentioned deficiencies in the prior art, the present invention provides an information security detection method for a blockchain system, which sequentially triggers intelligent detection at the algorithm layer, intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer to cope with security risks existing in different levels of the blockchain framework.

[0004] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0005] An information security detection method for a blockchain system, the information security detection includes intelligent detection at the algorithm layer, intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer. When the security detection is triggered, the intelligent detection at the algorithm layer is started, and the intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer are triggered in sequence. Each level of the intelligent detection at the algorithm layer, intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer adopts the following detection steps:

[0006] A: Identify and evaluate the input or intercepted message information, and establish a database of common vulnerabilities at each level. During the identification and evaluation process, each level first matches the detected information with vulnerabilities to determine whether a recorded vulnerability is found in the detected information. If the vulnerability match is successful, the relevant report is directly output. If the match is unsuccessful, vulnerability analysis is performed;

[0007] B: Analyze the detection information that is not matched successfully and is unknown whether there is a vulnerability. If it is determined that the detection information has a vulnerability, the system will generate vulnerability information and patch it or make suggestions to improve the vulnerability. At the same time, the vulnerability information will be stored in the vulnerability database. The patching or suggestions for improving the vulnerability will be analyzed repeatedly until it is determined that there is no vulnerability in the detection object. The security test passes and enters the next level of vulnerability detection;

[0008] C: Generate logs and blocks to achieve data storage and transmission. When the system determines that a certain level of security detection has passed, the vulnerability analysis report and vulnerability resolution status of this level will be recorded in the form of logs, and communicated in context. Smart contracts are used to generate blocks based on logs. After that, each level will combine the hash of the block of the previous level to generate the block of that level.

[0009] Furthermore, in step B, for the algorithm layer intelligent detection, vulnerability analysis is performed by triggering the hash algorithm anti-collision detection, and the hash algorithm anti-collision detection includes the following detection steps:

[0010] S101: Pre-construct a differential with a high probability of collision for the hash algorithm to be detected;

[0011] S102: deriving a path for the constructed difference, analyzing and calculating sufficient conditions for realizing the path, and determining the complexity of the operation based on the sufficient conditions;

[0012] S103: Use message modification technology to search for collision message pairs that meet sufficient conditions. If a collision message pair is found, it proves that the algorithm does not have high collision resistance. If the probability of messages that meet sufficient conditions is very low, it proves that the hash algorithm has high collision resistance.

[0013] Furthermore, in step B, for the algorithm layer intelligent detection, vulnerability analysis is performed by triggering the encryption algorithm ductility attack detection. The encryption algorithm ductility attack detection is performed by making a one-to-one comparison between the transactions and their TXIDs within the detection period. If the transaction cannot be queried using the TXID, it is marked that there is a transaction ductility attack risk vulnerability. If the TXID and the transaction can correspond one-to-one, it is determined that the encryption algorithm does not have a transaction ductility attack risk vulnerability.

[0014] Furthermore, in step B, for the intelligent detection of the protocol layer, vulnerability analysis is performed by triggering the protocol performance analysis. The protocol performance analysis mainly conducts a comprehensive analysis of the consensus protocol used by the platform from five aspects: time efficiency, resource consumption, security, scalability, and openness. Combined with the operation mode of the platform, it is determined whether the use of the consensus protocol is applicable and whether there are certain performance problems. According to the performance situation, the attack threats faced by the platform are analyzed, and finally suggestions for improvement are given.

[0015] Furthermore, the consensus protocol includes POW protocol, POS protocol, and DPOS protocol.

[0016] Further, in step B, for the implementation layer intelligent detection, vulnerability analysis is performed by triggering fuzz testing, and the fuzz testing includes the following detection steps:

[0017] S201: Analyze the input data characteristics of the smart contract to be tested in advance, and construct fuzzy test cases for common vulnerabilities;

[0018] S202: Build a private chain for the smart contract that needs to pay tokens to execute, deploy the smart contract to be tested on the private chain, and then input the constructed semi-random use case through the interface to perform fuzz testing;

[0019] S203: Use a monitor to monitor. If the fuzzy test case causes the program to be abnormal, locate it and determine whether the relevant smart contract has a corresponding vulnerability.

[0020] Further, in step B, for the use layer intelligent detection, vulnerability analysis is performed by triggering a side channel attack test, and the side channel attack test includes the following detection steps:

[0021] S301: Collect detailed information about the software and hardware, implementation details, etc. of the password during use to determine the side channel vulnerability points;

[0022] S302: Design a leakage model for side channel analysis based on the side channel vulnerability, construct a distinguisher for correct and incorrect keys, then select a suitable analysis method based on the type of leakage information, and determine the anti-side channel capability of the encryption algorithm by performing side channel analysis.

[0023] Further, in step B, for system-level intelligent detection, vulnerability analysis is performed by triggering a vulnerability test, and the vulnerability test includes the following detection steps:

[0024] S401: construct a semi-random test case according to the block information obtained at the interface, and input the test case through the interface;

[0025] S402: deploying a monitor at the interface, the monitor monitors and records the block data and related status data in the fuzzy test in real time;

[0026] S403: By comparing and analyzing the original data and the test data collected by the monitor, it is determined whether there are loopholes in the system based on the difference between the two.

[0027] Furthermore, the information security detection method realizes automatic response and circulation of vulnerability detection from algorithm layer intelligent detection to system layer intelligent detection through workflow technology.

[0028] Furthermore, the information security detection method is based on a destructive blockchain security threat framework and a network security framework.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] (1) The information security detection method of the present invention sets up intelligent detection at the algorithm layer, intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer, and starts from the intelligent detection at the algorithm layer, and sequentially triggers intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer. Each level includes identifying and evaluating the input or intercepted message information; analyzing the detection content of unknown vulnerabilities, and collecting vulnerability information at the same time; generating logs and blocks, and realizing data storage and transmission. The present invention innovatively proposes a systematic blockchain security detection method, and has made technical breakthroughs in five aspects, namely, algorithm, protocol, usage, implementation, and system, to deal with the security risks existing in different levels of the blockchain framework. The present invention fills the research gap in the field of blockchain security to a large extent.

[0031] (2) The algorithm layer intelligent detection of the present invention performs vulnerability analysis by triggering the anti-collision detection of the hash algorithm and the ductility attack detection of the encryption algorithm, thereby eliminating the hash collision problem of the hash algorithm and the transaction ductility attack threat of the signature algorithm.

[0032] (3) The protocol layer intelligent detection of the present invention performs vulnerability analysis by triggering protocol performance analysis to determine whether the consensus protocol used is applicable and whether there are certain performance problems. It analyzes the attack threats faced by the platform based on the performance situation and finally gives suggestions for improvement.

[0033] (4) The implementation layer intelligent detection of the present invention performs vulnerability analysis by triggering fuzz testing and mining vulnerabilities in smart contract code, detects common vulnerabilities currently existing in smart contracts and provides improvement suggestions.

[0034] (5) The present invention uses layer intelligent detection to perform vulnerability analysis by triggering a side channel attack test, tests the encryption algorithm's ability to resist side channel attacks, detects related vulnerabilities, and prevents attackers from entering.

[0035] (6) The system-level intelligent detection of the present invention performs vulnerability analysis by triggering vulnerability testing, detects input vulnerabilities, and prevents attackers from attacking the blockchain system by inputting vulnerability codes.

[0036] (7) The present invention realizes the automatic response and cycle of vulnerability detection from algorithm-level intelligent detection to system-level intelligent detection through workflow technology, as well as the establishment of a process including evaluation, analysis, processing, collection, storage and transmission of vulnerability information. By taking the destructive blockchain security threat framework and the network security framework as the basis for establishing the information security detection method, the systematic nature of the established method can be effectively improved while enhancing the reliability and stability of the practice. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a schematic diagram of the overall flow of the safety detection method of the present invention.

[0038] Figure 2 It is a schematic diagram of the security hierarchy framework of the security detection method of the present invention.

[0039] Figure 3 It is a schematic diagram of the security process and security dimensions of the security detection method of the present invention.

[0040] Figure 4 It is a schematic diagram of the algorithm layer intelligent detection process of the present invention.

[0041] Figure 5 It is a schematic diagram of the protocol layer intelligent detection process of the present invention.

[0042] Figure 6 It is a schematic diagram of the intelligent detection process of the implementation layer of the present invention.

[0043] Figure 7 It is a schematic diagram of the intelligent detection process of the usage layer of the present invention.

[0044] Figure 8 It is a schematic diagram of the system-level intelligent detection process of the present invention. DETAILED DESCRIPTION

[0045] The present invention is further described below in conjunction with the accompanying drawings and embodiments. The embodiments of the present invention include but are not limited to the following embodiments.

[0046] Example

[0047] like Figure 1-8 As shown, this embodiment provides an information security detection method for a blockchain system. The information security detection includes intelligent detection at the algorithm layer, intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer. When the security detection is triggered, the intelligent detection at the algorithm layer is started, and the intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer are triggered in sequence. Among them, each level of the intelligent detection at the algorithm layer, the intelligent detection at the protocol layer, the intelligent detection at the implementation layer, the intelligent detection at the usage layer, and the intelligent detection at the system layer adopts the following detection steps:

[0048] A: Identify and evaluate the input or intercepted message information, and establish a database for common vulnerabilities at each level. During the identification and evaluation process, each level first matches the detected information with vulnerabilities to determine whether a recorded vulnerability is found in the detected information. If the vulnerability match is successful, the relevant report is directly output. If the match is unsuccessful, vulnerability analysis is performed;

[0049] B: Analyze the detection information that is not matched successfully and is unknown whether there is a vulnerability. If it is determined that the detection information has a vulnerability, the system will generate vulnerability information and patch it or make suggestions to improve the vulnerability. At the same time, the vulnerability information will be stored in the vulnerability database. The patching or suggestions for improving the vulnerability will be analyzed repeatedly until it is determined that there is no vulnerability in the detection object. The security test passes and enters the next level of vulnerability detection;

[0050] C: Generate logs and blocks to achieve data storage and transmission. When the system determines that a certain level of security detection has passed, the vulnerability analysis report and vulnerability resolution status of this level will be recorded in the form of logs, and communicated in context. Smart contracts are used to generate blocks based on logs. After that, each level will combine the hash of the block of the previous level to generate the block of that level.

[0051] The information security detection method of this embodiment is established based on the destructive blockchain security threat framework and the network security framework proposed by NIST. A full-process blockchain system security detection method is designed for the five security levels of the blockchain, namely algorithm security, protocol security, implementation security, usage security and system security. A full-process solution is proposed to address the vulnerabilities existing at all levels of the blockchain, expand the extension of the existing information security theoretical framework, fill the gap in existing blockchain security research, and propose solutions for subsequent related research.

[0052] In this embodiment, the security level division method adopted by the information security detection method is based on the three-level division method of blockchain, namely, the protocol layer, the extension layer and the application layer. The algorithm layer is stripped out and integrated with the protocol layer to form a core layer, forming a new blockchain three-layer framework design. Figure 2 As shown in the figure, the whole method relies on the blockchain algorithm as the underlying technology, including asymmetric encryption technology, distributed systems, peer-to-peer computing and smart contracts. On the basis of the algorithm layer, the protocol layer completes the functions of data storage, network communication, distributed computing, etc. on the one hand, and uses mature protocols to motivate participants to participate in consensus on the other hand. The extension layer is based on the algorithm and protocol of the blockchain system, and uses a variety of technologies to expand the blockchain system and consensus mechanism to achieve the following Figure 2The functions shown in the figure include identity management, protocol management, application services, system management, and smart contracts. The application layer is the interactive level where blockchain applications directly face users. The blockchain system is productized and front-end development and other technologies are used to transform blockchain applications into blockchain application products.

[0053] In this embodiment, based on Figure 2 In the blockchain hierarchical framework, when blockchain application products are put into the market and are used by users, blockchain applications interact with users. In this process, this embodiment adds a new layer of user layer. The granularity of the user layer can range from individuals to organizations and then to countries. The specific blockchain application process is as follows: Figure 3 As shown in the dotted box, the blockchain system cycle is implemented in the dotted box. Based on the core layer and the extension layer, the blockchain application is implemented; the application layer forms the blockchain application and pushes the application to users; users use the blockchain application. The whole process is as follows Figure 3 As shown in the arrows, there are five major security issues in the blockchain application proposed in this embodiment, namely: algorithm security issues, that is, the code vulnerability threat of the encryption algorithm itself in the communication protocol threat; protocol security issues, which refer to the performance of the consensus protocol itself and several attack threats that are easily suffered due to the performance; implementation security issues, that is, the coding vulnerability threat existing in the smart contract; usage security issues, that is, several types of attack threats that the encryption algorithm is prone to suffer during use; system security issues, that is, system security threats existing in the blockchain operating environment.

[0054] In this embodiment, at the algorithm layer, we mainly discuss how to perform security detection on the code vulnerabilities of the encryption algorithm itself. Common threats at the algorithm layer are mainly hash collision problems of hash algorithms and transaction extension attacks on signature algorithms.

[0055] Hash collision refers to the situation where different input information generates the same hash value after being calculated by the same hash algorithm. Among the common hash algorithms currently used in the blockchain system, those with strong anti-collision properties include SHA256, SHA-3, and RIPEMD-160. However, with the continuous improvement of computer capabilities, the MD5 and SHA1 hash algorithms that were once widely used in the security field have been proven to not have strong anti-collision properties.

[0056] In this embodiment, the encryption algorithm type is first identified and evaluated. For encryption algorithms that can be matched in the vulnerability database, for example, it is identified that the platform uses the Curl hash function, and the vulnerability database has recorded that it has a serious hash collision vulnerability. It is evaluated that the encryption algorithm is not suitable for the blockchain platform using the POW consensus mechanism. The system will output the relevant vulnerability report for the user to decide whether to replace or improve the hash algorithm. If the encryption algorithm used by the platform and the related vulnerability information are not recorded in the database, the vulnerability analysis phase will be entered.

[0057] The anti-collision test of the hash algorithm uses a differential attack algorithm. This method determines the anti-collision of the algorithm by comparing and analyzing the change propagation of plaintext with specific differences after hash encryption. The anti-collision test of the hash algorithm includes the following test steps:

[0058] S101: Pre-construct a differential with a high probability of collision for the hash algorithm to be detected;

[0059] S102: deriving a path for the constructed difference, analyzing and calculating sufficient conditions for realizing the path, and determining the complexity of the operation based on the sufficient conditions;

[0060] S103: Use message modification technology to search for collision message pairs that meet sufficient conditions. If a collision message pair is found, it proves that the algorithm does not have high collision resistance. If the probability of messages that meet sufficient conditions is very low, it proves that the hash algorithm has high collision resistance.

[0061] The detection of encryption algorithm malleability attacks is carried out by comparing the transactions and their TXIDs within the detection period one by one. If the transaction cannot be queried using the TXID, it is marked as a transaction malleability attack risk vulnerability. If the TXID and the transaction can be matched one by one, it is determined that the encryption algorithm does not have a transaction malleability attack risk vulnerability.

[0062] In this embodiment, at the protocol layer, the consensus protocol adopted by the blockchain system is mainly tested, including analyzing the performance of the consensus protocol itself, and judging the performance defects of the blockchain platform according to different performances. The performance and performance defects of common consensus protocols are shown in Table 1.

[0063] Table 1 Consensus protocol performance and performance defects

[0064]

[0065] First, the detected protocol type is identified and evaluated, and the existing protocol performance and common performance defects in the database are compared and matched. For those that can be matched, the vulnerability report is directly called out. For example, for a blockchain platform using the POW protocol, on the one hand, its performance information is retrieved, and on the other hand, its energy consumption problems and vulnerable attacks are evaluated and warned. For protocols that cannot match existing vulnerabilities, analysis is carried out.

[0066] The protocol performance analysis phase mainly conducts a comprehensive analysis of the consensus protocol used by the platform from five aspects: time efficiency, resource consumption, security, scalability, and openness. Combined with the platform's operating mode, it determines whether the consensus protocol is applicable and whether there are certain performance issues. Based on the performance situation, the attack threats faced by the platform are analyzed, and finally suggestions for improvement are given.

[0067] In this embodiment, the detection of the implementation layer is mainly to discover vulnerabilities in the smart contract code. At present, there are six common vulnerabilities in smart contracts, namely: function call vulnerabilities; overflow detection vulnerabilities; business logic vulnerabilities; semantic specification detection vulnerabilities; blockchain-level vulnerabilities; Ethereum virtual machine-level vulnerabilities.

[0068] First, the smart contract code input by the user is identified and evaluated. For the vulnerability code that matches successfully, a report of the type of vulnerability is directly output. If the match fails, the vulnerability detection method is used for fuzz testing. Fuzz testing technology is an automated or semi-automated testing technology. It inputs pre-constructed semi-valid use cases into the target program and monitors the status of the program to determine whether the program has vulnerabilities. Fuzz testing includes the following detection steps:

[0069] S201: Analyze the input data characteristics of the smart contract to be tested in advance, and construct fuzzy test cases for common vulnerabilities;

[0070] S202: Build a private chain for the smart contract that needs to pay tokens to execute, deploy the smart contract to be tested on the private chain, and then input the constructed semi-random use case through the interface to perform fuzz testing;

[0071] S203: Use a monitor to monitor. If the fuzzy test case causes the program to be abnormal, locate it and determine whether the relevant smart contract has a corresponding vulnerability.

[0072] In this embodiment, in addition to certain design loopholes and defects in the encryption algorithm itself, there are also certain cryptographic implementation loopholes when users use the encryption algorithm, which can be easily exploited by attackers. Side channel attacks are a type of attack method based on cryptographic implementation loopholes. It refers to the use of side channel information leakage such as time consumption and power consumption to attack encryption-related content. Generally, side channel attacks are low in cost and have high versatility. Once implemented, they will cause powerful attacks. Therefore, they are a common attack method. The focus of security vulnerability detection at the usage layer is to test the encryption algorithm's ability to resist side channel attacks.

[0073] First, the type of cryptographic module (including information on software, firmware, hardware, etc.), the type of cryptographic algorithm, and whether the anti-side channel defense mechanism is used by the blockchain platform are identified. Based on the identified information, the cryptographic anti-side channel attack capability is preliminarily evaluated. If the evaluation result is that the anti-side channel capability is strong, the report is directly output. If the evaluation result is that the anti-side channel capability is weak, the anti-side channel attack capability analysis and detection phase is entered.

[0074] The use layer uses formal verification methods to perform side channel attack tests. Formal verification methods mainly use mathematical methods, including mathematical formulas and theorems, to build models to detect the correctness of the system. Side channel attack tests include the following detection steps:

[0075] S301: Collect detailed information about the software and hardware, implementation details, etc. of the password during use to determine the side channel vulnerability points;

[0076] S302: Design a leakage model for side channel analysis based on the side channel vulnerability, construct a distinguisher for correct and incorrect keys, then select a suitable analysis method based on the type of leakage information, and determine the anti-side channel capability of the encryption algorithm by performing side channel analysis.

[0077] In this embodiment, system-layer vulnerabilities mainly refer to attacks that the blockchain system is susceptible to during operation, such as some input-type vulnerabilities, which attack by inputting vulnerability codes into the blockchain system. In this embodiment, system-layer vulnerability detection is mainly designed for input code vulnerabilities.

[0078] First, an interface is set up at the block production node to collect block information and user operation information to intercept messages, and the intercepted message information is matched, identified and evaluated with the vulnerability information database. If the vulnerability match is successful, the vulnerability report is directly output. If the match fails, the vulnerability test is performed. The system layer uses fuzzy testing to detect vulnerabilities. The vulnerability test includes the following detection steps:

[0079] S401: construct a semi-random test case according to the block information obtained at the interface, and input the test case through the interface;

[0080] S402: deploying a monitor at the interface, the monitor monitors and records the block data and related status data in the fuzzy test in real time;

[0081] S403: By comparing and analyzing the original data and the test data collected by the monitor, it is determined whether there are loopholes in the system based on the difference between the two.

[0082] In this embodiment, the information security detection method realizes automatic response and cycle of vulnerability detection from algorithm layer intelligent detection to system layer intelligent detection through workflow technology. Workflow is a computerized representation model of the business process, which defines various parameters required to complete the entire process. These parameters include the definition of each individual step in the process, the execution order between steps, the establishment of conditions and data flow, who is responsible for each step, and the application required for each activity.

[0083] The workflow can define states, events, roles, and conversion methods in the process, thereby generating workflow logic and specifications. According to the workflow specifications, smart contracts are generated and deployed on the blockchain network. The states of the workflow and events of state changes are stored in the log files of the blockchain network through smart contracts. This embodiment adopts BPMN (Business Process Model and Notation) workflow modeling technology, and uses DRAW.IO tools to implement workflow modeling for blockchain security detection. The security workflow adopts a bottom-up approach to determine the security status of each security dimension in turn.

[0084] In this embodiment, the information security detection method is based on the destructive blockchain security threat framework and the network security framework. Based on the destructive blockchain security threat framework proposed by Mahendra et al., this embodiment establishes an information security detection method. Specifically, the destructive blockchain security threat framework proposes five major categories of blockchain security threats, including environmental threats, communication protocol threats, consensus protocol threats, smart contract threats and encryption algorithm threats during the operation of the blockchain. Therefore, combined with the four major security levels involved in blockchain security - algorithm layer, protocol layer, extension layer, and application layer, the five security threats described in the destructive blockchain security threat framework are presented in this embodiment as five major security dimensions: algorithm security, protocol security, implementation security, usage security, and system security. The destructive blockchain security threat framework is used as the basis for the establishment of the information security detection method, which can effectively improve the systematic nature of the method established in this embodiment while enhancing the reliability and stability of the practice.

[0085] At the same time, the National Institute of Standards and Technology (NIST) pointed out in the "Overview of Blockchain Technology" that although the existing cybersecurity standards and frameworks are not designed solely for blockchain technology, nor are they a one-size-fits-all approach to managing cybersecurity risks, the breadth of its standards is sufficient to cover blockchain technology. Therefore, this method uses the cybersecurity framework proposed by NIST and the IS0 27K series of information security international standards as the basic design standards, and uses the techniques and methodologies proposed in the "Technical Guide for Information Security Testing and Evaluation" issued by NIST as a reference. Based on the five security levels in the security dimension, a full-process blockchain security vulnerability detection method is designed, and the automatic response and circulation of vulnerability detection events from the algorithm layer to the system layer are realized through workflow technology.

[0086] When the present invention is implemented, the information security detection method sets up intelligent detection at the algorithm layer, intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer, and starts from the intelligent detection at the algorithm layer, and sequentially triggers intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer. Each level includes identification and evaluation of input or intercepted message information; analysis of detection content for unknown vulnerabilities, and collection of vulnerability information; generation of logs and blocks, and storage and transmission of data. The present invention innovatively proposes a systematic blockchain security detection method, and has made technical breakthroughs in five aspects, namely, algorithm, protocol, usage, implementation, and system, to deal with security risks existing in different levels of blockchain frameworks. The present invention fills the research gap in the field of blockchain security at home and abroad to a large extent.

[0087] The above embodiments are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Any changes made by adopting the design principles of the present invention and performing non-creative work on this basis should fall within the protection scope of the present invention.

Claims

1. An information security detection method for blockchain system, characterized in that : The information security detection includes intelligent detection at the algorithm layer, intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer. When the security detection is triggered, it starts with intelligent detection at the algorithm layer, and then triggers intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer in sequence. Each level of the intelligent detection at the algorithm layer, intelligent detection at the protocol layer, intelligent detection at the implementation layer, intelligent detection at the usage layer, and intelligent detection at the system layer adopts the following detection steps: A: Identify and evaluate the input or intercepted message information, and establish a database for common vulnerabilities at each level. During the identification and evaluation process, each level first matches the detected information with vulnerabilities to determine whether a recorded vulnerability is found in the detected information. If the vulnerability match is successful, the relevant report is directly output. If the match is unsuccessful, vulnerability analysis is performed; B: Analyze the detection information of unknown vulnerabilities that have not been successfully matched. If it is determined that the detection information has vulnerabilities, the system will generate vulnerability information and patch or make suggestions for improving the vulnerabilities. At the same time, the vulnerability information will be stored in the vulnerability database, and the patch or suggestions for improving the vulnerabilities will be analyzed cyclically until it is determined that there are no vulnerabilities in the detection object. The security detection passes and enters the next level of vulnerability detection; in this step, for the algorithm layer intelligent detection, the vulnerability analysis is performed by triggering the hash algorithm anti-collision detection, and the hash algorithm anti-collision detection includes the following detection steps: S101: Pre-construct a differential with a high probability of collision for the hash algorithm to be detected; S102: deriving a path for the constructed difference, analyzing and calculating sufficient conditions for realizing the path, and determining the complexity of the operation based on the sufficient conditions; S103: Searching for collision message pairs that meet sufficient conditions by using message modification technology. If a collision message pair is found, it proves that the hash algorithm does not have high collision resistance. If the probability of messages that meet sufficient conditions is very low, it proves that the hash algorithm has high collision resistance. For the implementation layer intelligent detection, vulnerability analysis is performed by triggering fuzz testing, which includes the following detection steps: S201: Analyze the input data characteristics of the smart contract to be tested in advance, and construct fuzzy test cases for common vulnerabilities; S202: Build a private chain for the smart contract that needs to pay tokens to execute, deploy the smart contract to be tested on the private chain, and then input the constructed semi-random use case through the interface to perform fuzz testing; S203: Use a monitor to monitor, and if the fuzzy test case causes the program to be abnormal, locate it and determine whether the relevant smart contract has a corresponding vulnerability; C: Generate logs and blocks to achieve data storage and transmission. When the system determines that a certain level of security detection has passed, the vulnerability analysis report and vulnerability resolution status of this level will be recorded in the form of logs, and communicated in context. Smart contracts are used to generate blocks based on logs. After that, each level will combine the hash of the block of the previous level to generate the block of that level.

2. According to claim 1, an information security detection method for a blockchain system is characterized in that: In step B, for algorithm layer intelligent detection, vulnerability analysis is performed by triggering encryption algorithm ductility attack detection. The encryption algorithm ductility attack detection is performed by comparing the transactions and their TXIDs within the detection period one by one. If the transaction cannot be queried using the TXID, it is marked that there is a transaction ductility attack risk vulnerability. If the TXID and the transaction can correspond one by one, it is determined that the encryption algorithm does not have a transaction ductility attack risk vulnerability.

3. According to claim 1, an information security detection method for a blockchain system is characterized in that: In step B, for intelligent detection at the protocol layer, vulnerability analysis is performed by triggering protocol performance analysis. The protocol performance analysis mainly conducts a comprehensive analysis of the consensus protocol used by the platform from five aspects: time efficiency, resource consumption, security, scalability, and openness. Combined with the platform's operating mode, it is determined whether the consensus protocol is applicable and whether there are certain performance issues. Based on the performance situation, the attack threats faced by the platform are analyzed, and finally suggestions for improvement are given.

4. According to claim 3, an information security detection method for a blockchain system is characterized in that: The consensus protocols include POW protocol, POS protocol and DPOS protocol.

5. According to claim 2, an information security detection method for a blockchain system is characterized in that: In step B, for the use layer intelligent detection, vulnerability analysis is performed by triggering a side channel attack test, and the side channel attack test includes the following detection steps: S301: Collect detailed information on the software and hardware and implementation details of the password during use to determine the side channel vulnerability points; S302: Design a leakage model for side channel analysis based on the side channel vulnerability, construct a distinguisher for correct and incorrect keys, then select a suitable analysis method based on the type of leakage information, and determine the anti-side channel capability of the encryption algorithm by performing side channel analysis.

6. According to claim 1, an information security detection method for a blockchain system is characterized in that: In step B, for system-level intelligent detection, vulnerability analysis is performed by triggering a vulnerability test, which includes the following detection steps: S401: construct a semi-random test case according to the block information obtained at the interface, and input the test case through the interface; S402: deploying a monitor at the interface, the monitor monitors and records the block data and related status data in the fuzzy test in real time; S403: By comparing and analyzing the original data and the test data collected by the monitor, it is determined whether there are loopholes in the system based on the difference between the two.

7. The information security detection method for a blockchain system according to claim 1, characterized in that: The information security detection method realizes automatic response and circulation of vulnerability detection from algorithm layer intelligent detection to system layer intelligent detection through workflow technology.

8. An information security detection method for a blockchain system according to any one of claims 1 to 7, characterized in that: The information security detection method is based on the destructive blockchain security threat framework and the network security framework.

Images